Describe Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview SC-900 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A security administrator suspects that a user has been downloading sensitive files from SharePoint Online and sending them to a personal email address. The administrator needs to find evidence of these activities in the audit log. What should the administrator search for in Audit Log Search?

   • ASearch for 'FileModified' events for the user in SharePoint and 'MailboxLogin' events in Exchange Online.
   • BSearch for 'FileDownloaded' events for the user in SharePoint and 'Send' events in Exchange Online.
   • CSearch for 'FileAccessed' events for the user in SharePoint and 'MessageSent' events in Teams.
   • DSearch for 'FileDeleted' events for the user in SharePoint and 'EmailForwarded' events in Exchange Online.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is an example of an Advanced Audit event in Microsoft Purview?

   • AFileDownloaded
   • BUserLoggedIn
   • CPasswordChanged
   • DMailItemsAccessed
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A compliance officer needs to verify whether any user downloaded a large number of files from SharePoint in the last week. They have Microsoft 365 E5 licenses. What should they do?

   • ASearch the unified audit log for SharePoint file download events and filter by user and date.
   • BUse Insider Risk Management to view the user's risk score.
   • CCheck the SharePoint admin center's storage reports.
   • DRun a Content Search for files with 'download' in the name.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   Contoso Pharmaceuticals has a research team that works with highly confidential drug formulas. The compliance team is concerned about a specific researcher who has been downloading large volumes of files to a personal USB drive and sending emails with attachments to personal addresses. The compliance team wants to monitor this specific user's activity for potential data exfiltration without creating alerts for the entire research department. What should the compliance team configure in Microsoft Purview?

   • ACreate an insider risk policy scoped to the specific researcher with indicators for USB device activity and email exfiltration.
   • BEnable the default insider risk policy for all research department users and then review the alerts generated for the researcher.
   • CUse Content Search to find all emails sent by the researcher and all files copied to USB drives.
   • DConfigure an audit log search policy to track the researcher's file access and email activity.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A manufacturing company is concerned about employees sending sensitive design files to personal email accounts. The compliance team wants to detect this activity without disrupting normal work. They plan to use Microsoft Purview Insider Risk Management. Which configuration should they implement first?

   • ACreate an insider risk policy using the Data theft template, add a priority user group for employees with access to design files, and enable the indicator for sending email to personal domains.
   • BEnable Advanced Audit and then run a Content Search for emails containing 'design' sent to external addresses.
   • CCreate an eDiscovery case and place a hold on all employees' mailboxes to preserve evidence of data exfiltration.
   • DConfigure a Data Loss Prevention (DLP) policy to block all emails containing design files to external recipients.
   Reveal Solution Discussion Select an answer first